Makefile

TEST?=$$(go list ./... | grep -v 'vendor')
TEST_ACC=$$(grep -rl 'func TestAcc' --include='*_test.go' . | xargs dirname | sort -u)
HOSTNAME=terraform
NAMESPACE=provider
NAME=stackguardian
BINARY=terraform-provider-${NAME}
VERSION=0.0.0-dev
OS_ARCH=linux_amd64

default: install

clean: clean-examples

clean-examples:
	find examples/ -type d -name '.terraform' -exec rm -rv {} \+
	find examples/ -type f -name '.terraform.lock.hcl' -exec rm -v {} \+
	find examples/ -type f -regextype posix-extended -regex '.+.tfstate(.[[:digit:]]+)?(.backup)?' -exec rm -v {} \+

build:
	go build -o ${BINARY}

release:
	goreleaser release --clean --snapshot --skip-publish --skip-sign

install: build
	mkdir -p ~/.terraform.d/plugins/${HOSTNAME}/${NAMESPACE}/${NAME}/${VERSION}/${OS_ARCH}
	mv ${BINARY} ~/.terraform.d/plugins/${HOSTNAME}/${NAMESPACE}/${NAME}/${VERSION}/${OS_ARCH}

clean-test-cache:
	go clean -testcache

test:
	echo $(TEST) | xargs -t -n4 go test $(TESTARGS) -timeout=30s -parallel=4

# -p=8 runs up to 8 packages concurrently so the two heaviest packages
# (workflow_template_revision ~327s and workflow_from_template ~247s)
# overlap instead of landing in separate batches. Safe now that every test
# uses acctest.ResourceName for unique identifiers.
# -parallel=1 keeps t.Parallel() tests sequential within each package (none
# of the TestAcc functions use t.Parallel() today, but the flag is a guard).
test-acc:
	TF_ACC=1 go test -p=8 -parallel=1 $(TEST_ACC) -v $(TESTARGS) -timeout=15m

# Terraform CLI compatibility gate. Needs no API credentials: it only makes the
# CLI load the provider and decode its schema, then validates docs-examples/.
# Override the CLI under test with TERRAFORM_BIN=/path/to/terraform.
tf-compat-check:
	bash scripts/tf-compat-check.sh

# Reports resources an earlier acceptance run left behind. Read-only: it lists
# what carries the test prefix and deletes nothing.
test-acc-sweep:
	SG_ACC_SWEEP=1 go test ./internal/acctest -run TestSweepOrphans -v -count=1

# Deletes them. Only touches names carrying the acctest prefix.
test-acc-sweep-apply:
	SG_ACC_SWEEP=1 SG_ACC_SWEEP_APPLY=1 go test ./internal/acctest -run TestSweepOrphans -v -count=1

test-examples-quickstart:
	bash docs-guides-assets/quickstart/test-quickstart.sh $(ARGS)

test-examples-onboarding:
	bash docs-guides-assets/onboarding/project-test/test-onboarding.sh $(ARGS)

# The banner step is temporary, for as long as the docs revamp is in progress.
# Delete the line below and re-run to remove the banner from every page.
docs-generate:
	tfplugindocs generate \
		--provider-name stackguardian --website-source-dir docs-templates
	bash scripts/inject-docs-banner.sh

docs-validate:
	tfplugindocs validate --provider-name stackguardian

# Fails if docs/ is not what docs-templates/ + the current schemas generate.
# Without this, a schema change silently leaves the published docs stale.
docs-check: docs-generate
	@git diff --exit-code -- docs/ \
		|| { echo ""; echo "ERROR: docs/ is out of date. Run 'make docs-generate' and commit the result."; exit 1; }

# Type-checks every documentation example against the provider schema: the files
# under docs-examples/ and docs-guides-assets/, plus every ```terraform block
# embedded in page and guide prose (see scripts/extract-doc-blocks.py).
# No credentials and no API calls -- `terraform validate` only.
docs-validate-examples:
	bash scripts/validate-examples.sh

tools-install:
	cd tools; go install github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs

gh-workflow-test-provider:
	act \
		--workflows ${PWD}/.github/workflows/test.yaml \
		--job provider-project_test \
		--secret SG_PRD_API_URI=${SG_PRD_API_URI} \
		--secret SG_PRD_API_KEY=${SG_PRD_API_KEY} \
		--secret SG_PRD_ORG_NAME=${SG_PRD_ORG_NAME} \
		push \
		;

gh-workflow-test-provider-mock-stg-as-prd:
	act \
		--workflows ${PWD}/.github/workflows/test.yaml \
		--job provider-project_test \
		--secret SG_PRD_API_URI=${SG_STG_API_URI} \
		--secret SG_PRD_API_KEY=${SG_STG_API_KEY} \
		--secret SG_PRD_ORG_NAME=${SG_STG_ORG_NAME} \
		push \
		;

gh-workflow-test-api-stg:
	act \
		--workflows ${PWD}/.github/workflows/test-api-stg.yaml \
		--secret SG_STG_API_URI=${SG_STG_API_URI} \
		--secret SG_STG_API_KEY=${SG_STG_API_KEY} \
		--secret SG_STG_ORG_NAME=${SG_STG_ORG_NAME} \
		workflow_dispatch \
		;

gh-workflow-test-api-prd:
	act \
		--workflows ${PWD}/.github/workflows/test-api-prd.yaml \
		--secret SG_PRD_API_URI=${SG_PRD_API_URI} \
		--secret SG_PRD_API_KEY=${SG_PRD_API_KEY} \
		--secret SG_PRD_ORG_NAME=${SG_PRD_ORG_NAME} \
		workflow_dispatch \
		;

# Security scan over AI agent skills using NVIDIA SkillSpector (static analysis
# only, --no-llm — no API key needed). Requires `skillspector` on PATH:
#   uv tool install git+https://github.com/NVIDIA/skillspector.git
# Fails when any skill scores above 50 (recommendation DO NOT INSTALL).
skills-security-scan:
	@mkdir -p .skillspector-reports; \
	fail=0; \
	for skill_dir in .claude/skills/*/; do \
		skill_name=$$(basename "$$skill_dir"); \
		echo "Scanning $$skill_name..."; \
		skillspector scan "$$skill_dir" --no-llm \
			--format sarif --output ".skillspector-reports/$$skill_name.sarif"; \
		rc=$$?; \
		if [ $$rc -eq 0 ]; then \
			echo "  $$skill_name: PASS"; \
		else \
			echo "  $$skill_name: FAIL (exit $$rc)"; \
			fail=1; \
		fi; \
	done; \
	exit $$fail